Control-plane failure: cached traffic has several expiration clocks

Envoy's xDS protocol documents that last-known configuration can remain available when a management server is unreachable. This separates data-plane forwarding from continuous control-plane participation. However, TTL-bearing resources can expire where that feature is supported and configured, and an individual resource type determines the effect of expiration. A rejected update also does not automatically erase every previously valid resource. Inspect accepted configuration, pending dependencies, stream connectivity, and resource expiry rather than inferring forwarding behavior from the control channel's connection status alone.

Existing proxy state and new proxy bootstrap are different scenarios. A dynamically configured proxy with no usable initial listeners or routes may be unable to serve while an already configured neighbor continues. A restarted process cannot be assumed to retain another process's in-memory state; persistence or static fallback would need an explicit design. New endpoints and policy changes also cannot be learned through a disconnected management path. Keeping old routes available is useful, but a stale route to a terminated workload or an outdated authorization decision can still fail the application's requirements.

If the unavailable component also supplies workload credentials or their signer, existing credentials can approach expiry without successful rotation. New TLS handshakes then face the actual certificate-validation rules and current trust material. Established TLS connections do not necessarily revalidate their peer's certificate before every application request, while configured connection-age or drain rules can end them. Do not assume all sessions die at the notAfter instant or that existing sessions make certificate expiry harmless. Test new and existing connections separately under the chosen transport and policy.

The identity provider, trust-bundle distribution, DNS, orchestrator, and xDS management service need not share one failure boundary. A mesh deployment can use an external CA or independent identity agents. State exactly which dependency is unavailable before assigning a horizon. A twenty-minute endpoint-resource TTL, fifty-minute credential headroom, and ten-minute operational freshness budget are three different constraints. The last is an application requirement unless a mechanism enforces it; treating all three as identical automatic proxy timers would misdescribe the system.

After recovery, verify resource versions, rejected updates, warmed dependencies, endpoint convergence, and credential renewal across the fleet. A connected stream can still carry configuration that some clients reject. A burst of reconnecting proxies can load management servers and signers, so examine retry backoff and staged recovery. Include a proxy restart during the outage and a newly deployed workload that lacks prior state. Those tests reveal a different weakness than a test that disconnects only a fully warmed, unchanged service for a few seconds.

The Markov lab isolates why average availability is insufficient. Reset, set p=0.10 and q=0.40, predict first-step disconnected probability 0.10 and stationary probability 0.20, then Play or Step. Separately Reset, set p=0.01 and q=0.04, predict first-step probability 0.01 and the same stationary probability 0.20, then Play or Step. Expected disconnected spells are 2.5 versus 25 abstract steps. These exact chain probabilities do not simulate management traffic or credentials. Their unbounded geometric spell tails explain why a finite operational recovery requirement needs stronger evidence than a long-run availability fraction.